~/ / AI articles / MCP specification 2026-07-28: what changed, and what to check in your own files
MCP specification 2026-07-28: what changed, and what to check in your own files
The Model Context Protocol (MCP) specification revision 2026-07-28 removes protocol-level sessions, deprecates the older HTTP+SSE transport and several features, and relaxes the rules for tool schemas. This article summarizes the official changelog and shows how to check two files that you write yourself: your MCP configuration and your tool schemas.
Published: · Checked against the official specification on 2026-10-24. This article summarizes it and does not replace it.
The biggest changes
- Protocol-level sessions and the Mcp-Session-Id header are removed from the Streamable HTTP transport. A server that needs state across calls uses explicit handles that it creates and passes as ordinary tool arguments.
- MCP becomes stateless: the initialize handshake is removed. Every request carries its protocol version and the client's capabilities in _meta, and a version mismatch returns UnsupportedProtocolVersionError.
- Servers must implement a new server/discover call that advertises their supported protocol versions, capabilities and identity.
- The HTTP GET endpoint and resources/subscribe are replaced by subscriptions/listen, one long-lived response stream for the change notifications that a client opts in to.
- Server-initiated requests such as roots/list, sampling/createMessage and elicitation/create are replaced by a Multi Round-Trip Requests pattern: the server returns a result that asks for input, and the client retries the original request with its answers.
- Experimental tasks move out of the core protocol into an official extension.
- Resumable SSE streams (Last-Event-ID) are removed. A broken response stream loses the request in flight, and the client must send it again as a new request.
What is now deprecated
| Feature | Deprecated in | Earliest removal | Suggested migration |
|---|---|---|---|
| Roots | 2026-07-28 | First revision released on or after 2027-07-28 | Pass directories or files through tool parameters, resource URIs or server configuration |
| Sampling | 2026-07-28 | First revision released on or after 2027-07-28 | Integrate directly with LLM provider APIs |
| Logging | 2026-07-28 | First revision released on or after 2027-07-28 | Log to stderr for stdio, or use OpenTelemetry |
| Dynamic Client Registration | 2026-07-28 | First revision released on or after 2027-07-28 | Client ID Metadata Documents |
| HTTP+SSE transport | 2025-03-26 | Three months after SEP-2596 reaches Final | Streamable HTTP |
| includeContext values thisServer and allServers | 2025-11-25 | Follows Sampling | Omit the field or use none |
A deprecated feature remains part of the specification. The earliest removal marks when it becomes eligible for removal, and the actual removal is a decision taken during release preparation. The new feature lifecycle policy sets a minimum deprecation window of twelve months.
Check your MCP configuration
If your configuration still uses the HTTP+SSE transport, it is on the deprecated list. Claude Code's documentation also calls its sse type deprecated and says to use HTTP servers where available. The specification describes the replacement, Streamable HTTP: the server exposes a single endpoint that accepts POST, and the client sends every JSON-RPC message as its own HTTP POST.
- Each POST must include an Accept header that lists both application/json and text/event-stream.
- Every POST must include an MCP-Protocol-Version header whose value matches the protocol version in the request body.
- Requests carry an Mcp-Method header, and an Mcp-Name header for tools/call, resources/read and prompts/get.
- The server answers each request with a single JSON object or with an SSE stream scoped to that request.
Which protocol revision your client supports is a question for your client's documentation. The checker below reads a .mcp.json or claude_desktop_config.json and reports entries such as a remote server with no type, or one that still uses sse.
Try it: MCP Config Checker
Rules checked against the documentation on 2026-10-23.
Documentation: Claude Code / Model Context Protocol / VS Code
Not checked: whether a command exists, whether a package installs, whether a remote server answers, and settings that other applications read differently.
Everything runs in your browser. The configuration is not uploaded.
Tool schemas can use all of JSON Schema 2020-12
- inputSchema and outputSchema now allow any JSON Schema 2020-12 keyword, and structuredContent can be any JSON value. The specification adds requirements for resolving $ref and bounds on the resources that composition keywords can use.
- A server can mark a tool parameter with x-mcp-header so that its value is copied into an Mcp-Param-{name} HTTP header. The marked parameter must be a string, an integer or a boolean, not a number.
- The marked property must be reachable from the schema root through properties keys only. The chain must not pass through items, oneOf, anyOf, allOf, not, if/then/else or $ref.
- A client that uses Streamable HTTP must reject a tool definition whose x-mcp-header annotation breaks these rules, which means the tool is left out of the tools/list result.
To test a tool schema, paste it with a sample set of arguments in the validator below. It checks the common keywords of Draft 2020-12 and tells you which ones it does not check.
Try it: JSON Schema Validator
Follows JSON Schema Draft 2020-12 for the keywords it supports. It reads $ref only inside the same schema.
Everything runs in your browser. The schema and the data are not uploaded.
Security points for servers
- A server must validate the Origin header on all incoming connections to prevent DNS rebinding attacks. If the header is present and invalid, it must answer with HTTP 403 Forbidden.
- A server that runs locally should bind only to localhost (127.0.0.1), not to all network interfaces (0.0.0.0).
- Servers should implement proper authentication for all connections.
- A server that processes the request body must reject a request whose headers do not match the body, with HTTP 400 and the JSON-RPC error HeaderMismatch (code -32020).
- Authorization servers should include the iss parameter in authorization responses (RFC 9207), and when an iss is present, clients must validate it before they redeem the authorization code.
- Clients must key saved client credentials by the issuer that granted them, and must not reuse them with a different authorization server.